| View previous topic :: View next topic |
| Author |
Message |
Coder68
Trooper
Joined: Oct 04, 2006
Posts: 15
Location: USA
|
 Posted: Mon Oct 09, 2006 11:16 pm Post subject: What is this? |
|
|
Here is the end of my GMER log. The first half is all clean, but this part I am unsure as to what it means. (Thread and ADS - ... )
| Quote: | ---- Threads - GMER 1.0.11 ----
Thread 4:180 82027F48
Thread 4:184 81FECA70
Thread 4:188 81FECA70
Thread 4:568 82027F48
Thread 4:712 82027F48
---- Files - GMER 1.0.11 ----
ADS C:\Documents and Settings\All Users\Application Data\PowerQuest\hpc:1617307125
ADS C:\Documents and Settings\All Users\Application Data\PowerQuest\hpc:2663419967
ADS ...
ADS ...
---- EOF - GMER 1.0.11 ---- |
I do have kaspersky AV 6 installed and Zone Alarm. (Only these files showed up in the missing part of my posted log.)
Can someone please shed some light on the threads and the ADS ... entries?
Thanks,
Coder68
|
|
| Back to top |
|
 |
PCBruiser
SRT Team Lead
Forums Admin
Joined: May 11, 2005
Posts: 11723
|
| Posted: Tue Oct 10, 2006 3:19 am Post subject: |
|
|
ADS = "Alternate Data Stream". See this for more info on that subject and what an ADS is.
http://en.wikipedia.org/wiki/Alternate_data_stream
In your case the ADS was created by PartitionMagic. Now if you don't have PartitionMagic installed on your system (or didn't have it installed in the past), then we need to delve a little deeper.
_________________
Don't read? Can't learn!
|
|
| Back to top |
|
|
Coder68
Trooper
Joined: Oct 04, 2006
Posts: 15
Location: USA
|
| Posted: Tue Oct 10, 2006 6:51 pm Post subject: |
|
|
My fault, I should have been more percise with my question... I know what ADS stands for and what it is... what I do not know is what the ADS ... is. I was assuming they went with Partiton Magic, but am unsure.
I have no clue what the 4 Threads are. So any help there would be great.
Thanks for your help!
Coder68
|
|
| Back to top |
|
|
negster22
Security Expert
Premium Member
Joined: Mar 10, 2004
Posts: 5394
|
| Posted: Tue Oct 10, 2006 10:04 pm Post subject: |
|
|
The latest version of GMER includes hidden thread detection. Those five hidden threads that you show are normal to see in the GMER log of KAV users, so there is no need to be concerned.
You probably left out the part of your log which showed the SSDT hooks created by KAV drivers klif.sys and kl1.sys.
_________________
Negster22 - MS MVP - Consumer Security 2006-2008 
|
|
| Back to top |
|
|
Coder68
Trooper
Joined: Oct 04, 2006
Posts: 15
Location: USA
|
| Posted: Wed Oct 11, 2006 2:24 am Post subject: |
|
|
Sweet. Thanks!
I did leave those out of the logs since I knew what they went to.
Thanks for the help.
Coder68
|
|
| Back to top |
|
|
|
|
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
